VillaTheme Customer Coupons EUVD-2026-110045

Requires a WordPress site running WooCommerce with the VillaTheme 'Customer Coupons for WooCommerce' (woo-customer-coupons) plugin at version 1.3.14 or earlier, AND an attacker holding a valid authenticated low-privilege account (PR:L - e.g. a registered customer/subscriber), since the plugin performs a sensitive action without a proper authorization check. Limiting factors: exploitation is gated on prior authentication (not reachable by fully anonymous users), impact is confined to limited integrity (no data disclosure or denial of service), and the specific feature/endpoint and trigger conditions are not described in the available sources. No user interaction is required.

This is a genuine-but-moderate priority (CVSS 4.3, Medium) broken-access-control / missing-authorization flaw (CWE-862). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N shows a network-reachable, low-complexity issue that nonetheless requires PR:L - an existing authenticated low-privilege account (e.g. a customer/subscriber) - and yields only limited integrity impact (I:L) with no confidentiality or availability loss. The vuln.today Decision label is 'this_month', consistent with a Medium severity that should be patched on a normal cycle rather than as an emergency. No EPSS score, no CISA KEV listing, and no SSVC decision-point data were supplied, so exploitation probability cannot be quantified from the input; absence of these signals is not evidence of safety but points away from mass automated exploitation. The 'Authentication Bypass' tag overstates the issue - CWE-862 and the reference title ('broken access control vulnerability') describe missing authorization on an action reachable by an already-authenticated user, not a bypass of authentication itself; treat the auth-bypass framing with caution. Overall: a real, authenticated, low-impact access-control defect worth routine remediation, not a drop-everything emergency.

An attacker who already holds a low-privileged WooCommerce account (such as a registered customer) sends a crafted request to a plugin endpoint that fails to verify the caller's authorization, performing an action they should not be permitted to and causing limited integrity impact. The precise action and trigger are not detailed in the available sources, and no public exploit code was identified. Exploitation requires an authenticated session but no user interaction and low attack complexity.